fix(pallet-tfgrid): enforce node_certification in farming policy limits (#1087)

* fix(pallet-tfgrid): enforce node_certification in farming policy limits

## Problem

The FarmingPolicyLimit.node_certification field was never enforced in
get_farming_policy(). Per the spec (docs/misc/minimal_DAO.md):

> Certification. If set, only certified nodes can get this policy.
> Non certified nodes get a default policy.

A Diy node on a farm with node_certification=true in its limits would
receive the certified-only policy instead of falling back to a default.

On mainnet, farm 2995 (GoldAndGreen) has 4 Diy nodes (2 currently
online) earning certified-level farming rewards on policy 3.

## Root Cause

Two issues:

1. No certification check in the FarmingPolicyLimit path of
   get_farming_policy() — limits only checked end, cu, su, node_count.

2. get_default_farming_policy() (called when limits are exhausted)
   ignored node/farm certification entirely — it just picked the
   highest-ranked default policy regardless of the node's actual
   certification. Per the spec, default policy selection should follow:
   - First: highest farm cert + certified nodes
   - Then: highest farm cert + non-certified nodes
   - Then: no farm cert + certified nodes
   - Last: no certification at all

## Fix

- Add node_certification check at the start of the limits path: Diy
  nodes on certified-only farms fall back to a matching default.

- Replace get_default_farming_policy() with get_default_farming_policy_for()
  that filters by both node_certification and farm_certification. This
  affects all 4 existing fallback paths (end expired, cu exceeded, su
  exceeded, node_count exhausted) plus the new certification check.

## Tests

- diy_node_gets_default_policy_when_limit_requires_certification:
  Diy node on Gold farm with node_certification=true gets policy 1
  (Diy+Gold default) instead of policy 3 (Certified+Gold limited)

- certified_node_gets_limited_policy_when_limit_requires_certification:
  Certified node correctly receives the limited policy

- diy_node_gets_limited_policy_when_no_certification_required:
  Diy node gets limited policy when node_certification=false

## Migration Note

This fix only affects future policy assignments. The 4 Diy nodes on
mainnet farm 2995 currently assigned policy 3 need a migration or
manual set_node_certification call to trigger re-evaluation.

Fixes #429

* fix(ci): use $GITHUB_WORKSPACE for git safe.directory in weights workflow (#1091)

The repository rename (tfchain -> ledger_chain) changed the runner checkout
path to /__w/ledger_chain/ledger_chain, but the safe.directory exception was
hardcoded to /__w/tfchain/tfchain, so git still rejected the repo with
"detected dubious ownership" (exit 128) at the Git config step.

Use $GITHUB_WORKSPACE so the exception always matches the real checkout path,
regardless of repository name.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: sameh-farouk

substrate-node/pallets/pallet-tfgrid/src/pricing.rs

@@ -196,18 +196,27 @@ impl<T: Config> Pallet<T> {
 
         // If there is a farming policy defined on the
         // farm policy limits, use that one
-        match farm.farming_policy_limits {
+        match farm.farming_policy_limits.clone() {
             Some(mut limits) => {
                 ensure!(
                     FarmingPoliciesMap::<T>::contains_key(limits.farming_policy_id),
                     Error::<T>::FarmingPolicyNotExists
                 );
+
+                // If the policy limit requires certified nodes, non-certified
+                // nodes get a default policy matching their certification.
+                if limits.node_certification
+                    && node.certification != NodeCertification::Certified
+                {
+                    return Self::get_default_farming_policy_for(node, &farm);
+                }
+
                 match limits.end {
                     Some(end_timestamp) => {
                         let now =
                             <pallet_timestamp::Pallet<T>>::get().saturated_into::<u64>() / 1000;
                         if now > end_timestamp {
-                            return Self::get_default_farming_policy();
+                            return Self::get_default_farming_policy_for(node, &farm);
                         }
                     }
                     None => (),
@@ -217,7 +226,7 @@ impl<T: Config> Pallet<T> {
                     Some(cu_limit) => {
                         let cu = node.resources.get_cu();
                         if cu > cu_limit {
-                            return Self::get_default_farming_policy();
+                            return Self::get_default_farming_policy_for(node, &farm);
                         }
                         limits.cu = Some(cu_limit - cu);
                     }
@@ -228,7 +237,7 @@ impl<T: Config> Pallet<T> {
                     Some(su_limit) => {
                         let su = node.resources.get_su();
                         if su > su_limit {
-                            return Self::get_default_farming_policy();
+                            return Self::get_default_farming_policy_for(node, &farm);
                         }
                         limits.su = Some(su_limit - su);
                     }
@@ -238,7 +247,7 @@ impl<T: Config> Pallet<T> {
                 match limits.node_count {
                     Some(node_count) => {
                         if node_count == 0 {
-                            return Self::get_default_farming_policy();
+                            return Self::get_default_farming_policy_for(node, &farm);
                         }
                         limits.node_count = Some(node_count - 1);
                     }
@@ -288,21 +297,25 @@ impl<T: Config> Pallet<T> {
         }
     }
 
-    // Set the default farming policy as the last best certified
-    // farming policy amoung all the default farming policies
-    fn get_default_farming_policy(
+    // Select the best matching default farming policy for the given node
+    // and farm certification levels.
+    fn get_default_farming_policy_for(
+        node: &TfgridNode<T>,
+        farm: &FarmInfoOf<T>,
     ) -> Result<types::FarmingPolicy<BlockNumberFor<T>>, DispatchErrorWithPostInfo> {
         let mut policies: Vec<types::FarmingPolicy<BlockNumberFor<T>>> =
             FarmingPoliciesMap::<T>::iter().map(|p| p.1).collect();
 
         policies.sort();
-        // by reversing sorted policies we place default policies first
-        // and then rank them from more certified to less certified
         policies.reverse();
 
         let possible_policy = policies
             .into_iter()
-            .filter(|policy| policy.default)
+            .filter(|policy| {
+                policy.default
+                    && policy.node_certification <= node.certification
+                    && policy.farm_certification <= farm.certification
+            })
             .take(1)
             .next();
 

substrate-node/pallets/pallet-tfgrid/src/tests.rs

@@ -1783,6 +1783,141 @@ fn attach_farming_policy_with_certified_node_certification_works() {
     });
 }
 
+#[test]
+fn diy_node_gets_default_policy_when_limit_requires_certification() {
+    ExternalityBuilder::build().execute_with(|| {
+        create_twin();
+        create_farm();
+        create_node();
+
+        let farm_id = 1;
+        let node_id = 1;
+
+        // Confirm node starts as Diy
+        let node = TfgridModule::nodes(node_id).unwrap();
+        assert_eq!(node.certification, NodeCertification::Diy);
+
+        // Attach farming policy 3 (certified) with node_certification = true
+        let fp = TfgridModule::farming_policies_map(3);
+        let limit = FarmingPolicyLimit {
+            farming_policy_id: fp.id,
+            cu: Some(100),
+            su: Some(100),
+            end: None,
+            node_certification: true,
+            node_count: Some(100),
+        };
+
+        assert_ok!(TfgridModule::attach_policy_to_farm(
+            RawOrigin::Root.into(),
+            farm_id,
+            Some(limit)
+        ));
+
+        // Diy node should NOT get the certified policy (3) — should fall back
+        // to the best matching default for a Diy node on a Gold farm, which is
+        // policy 1 (Diy + Gold)
+        let node = TfgridModule::nodes(node_id).unwrap();
+        assert_ne!(
+            node.farming_policy_id, fp.id,
+            "Diy node should not receive certified-only farming policy"
+        );
+        assert_eq!(
+            node.farming_policy_id, 1,
+            "Diy node on Gold farm should get policy 1 (Diy + Gold default)"
+        );
+    });
+}
+
+#[test]
+fn certified_node_gets_limited_policy_when_limit_requires_certification() {
+    ExternalityBuilder::build().execute_with(|| {
+        create_twin();
+        create_farm();
+        create_node();
+
+        let farm_id = 1;
+        let node_id = 1;
+
+        // Certify the node first
+        assert_ok!(TfgridModule::add_node_certifier(
+            RawOrigin::Root.into(),
+            alice()
+        ));
+        assert_ok!(TfgridModule::set_node_certification(
+            RuntimeOrigin::signed(alice()),
+            node_id,
+            NodeCertification::Certified
+        ));
+        let node = TfgridModule::nodes(node_id).unwrap();
+        assert_eq!(node.certification, NodeCertification::Certified);
+
+        // Attach certified-only policy
+        let fp = TfgridModule::farming_policies_map(3);
+        let limit = FarmingPolicyLimit {
+            farming_policy_id: fp.id,
+            cu: Some(100),
+            su: Some(100),
+            end: None,
+            node_certification: true,
+            node_count: Some(100),
+        };
+
+        assert_ok!(TfgridModule::attach_policy_to_farm(
+            RawOrigin::Root.into(),
+            farm_id,
+            Some(limit)
+        ));
+
+        // Certified node SHOULD get the limited policy
+        let node = TfgridModule::nodes(node_id).unwrap();
+        assert_eq!(
+            node.farming_policy_id, fp.id,
+            "Certified node should receive the certified-only farming policy"
+        );
+    });
+}
+
+#[test]
+fn diy_node_gets_limited_policy_when_no_certification_required() {
+    ExternalityBuilder::build().execute_with(|| {
+        create_twin();
+        create_farm();
+        create_node();
+
+        let farm_id = 1;
+        let node_id = 1;
+
+        // Confirm node is Diy
+        let node = TfgridModule::nodes(node_id).unwrap();
+        assert_eq!(node.certification, NodeCertification::Diy);
+
+        // Attach policy with node_certification = false (no restriction)
+        let fp = TfgridModule::farming_policies_map(3);
+        let limit = FarmingPolicyLimit {
+            farming_policy_id: fp.id,
+            cu: Some(100),
+            su: Some(100),
+            end: None,
+            node_certification: false,
+            node_count: Some(100),
+        };
+
+        assert_ok!(TfgridModule::attach_policy_to_farm(
+            RawOrigin::Root.into(),
+            farm_id,
+            Some(limit)
+        ));
+
+        // Diy node should get the limited policy since certification is not required
+        let node = TfgridModule::nodes(node_id).unwrap();
+        assert_eq!(
+            node.farming_policy_id, fp.id,
+            "Diy node should receive limited policy when node_certification is false"
+        );
+    });
+}
+
 #[test]
 fn attach_another_custom_farming_policy_to_farm_works() {
     ExternalityBuilder::build().execute_with(|| {